sneakoscope 4.0.13 → 4.0.15

package/dist/scripts/codex-lb-config-toml-safety-check.js

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// @ts-nocheck
+// Production invariant: a codex-lb config write must NEVER corrupt ~/.codex/config.toml,
+// especially on initial install. Every codex-lb writer routes through
+// safeWriteCodexConfigToml, which parse-gates current + next and backs up before mutating.
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const helpers = await importDist('cli/install-helpers.js');
+// Reproduce the on-disk parse smoke the runtime uses (unterminated triple-quote / bad header).
+function parses(text) {
+    const tripleTokens = (String(text).match(/"""|'''/g) || []).length;
+    if (tripleTokens % 2 !== 0)
+        return false;
+    const badHeader = String(text).split('\n').find((l) => /^\s*\[/.test(l) && !/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/.test(l));
+    return !badHeader;
+}
+const results = [];
+const BASE_URL = 'http://127.0.0.1:2455/backend-api/codex';
+// --- Case 1: fresh/empty config -> codex-lb provider added cleanly, parses ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-fresh-'));
+    const cfg = path.join(dir, 'config.toml');
+    const next = helpers.upsertCodexLbConfig('', BASE_URL);
+    const res = await helpers.safeWriteCodexConfigToml(cfg, '', next, 'codex-lb');
+    const after = await fs.readFile(cfg, 'utf8');
+    const ok = res.ok && /\[model_providers\.codex-lb\]/.test(after) && /^model_provider = "codex-lb"/m.test(after) && parses(after);
+    results.push({ case: 'fresh_adds_provider_parseable', ok, status: res.status });
+}
+// --- Case 2: existing config with a multiline string containing a bracketed line
+//     (the upsertTomlTable blind spot) must NEVER be written corrupted ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-multiline-'));
+    const cfg = path.join(dir, 'config.toml');
+    const tricky = [
+        'model = "gpt-5.1-codex"',
+        'custom_note = """',
+        'here is a note with a [not-a-real-header] inside a multiline string',
+        'second line',
+        '"""',
+        '',
+        '[mcp_servers.x]',
+        'command = "y"',
+        ''
+    ].join('\n');
+    await fs.writeFile(cfg, tricky);
+    const next = helpers.normalizeCodexFastModeUiConfig(helpers.upsertCodexLbConfig(tricky, BASE_URL));
+    const res = await helpers.safeWriteCodexConfigToml(cfg, tricky, next, 'codex-lb');
+    const after = await fs.readFile(cfg, 'utf8');
+    // INVARIANT: whatever happens, the on-disk config must still parse.
+    const ok = parses(after) && (res.ok ? /\[model_providers\.codex-lb\]/.test(after) : after === tricky);
+    results.push({ case: 'multiline_trap_never_corrupts', ok, status: res.status, on_disk_parses: parses(after) });
+}
+// --- Case 3: an already-unparseable existing config is preserved + backed up, not clobbered ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-broken-'));
+    const cfg = path.join(dir, 'config.toml');
+    const broken = 'model = "x"\n[features\nhooks = true\n';
+    await fs.writeFile(cfg, broken);
+    const next = helpers.upsertCodexLbConfig(broken, BASE_URL);
+    const res = await helpers.safeWriteCodexConfigToml(cfg, broken, next, 'codex-lb');
+    const after = await fs.readFile(cfg, 'utf8');
+    const backups = (await fs.readdir(dir)).filter((f) => f.includes('.sks-codex-lb-unparseable-'));
+    const ok = res.status === 'unparseable_config_preserved' && after === broken && backups.length >= 1;
+    results.push({ case: 'unparseable_preserved_backed_up', ok, status: res.status });
+}
+// --- Case 4: idempotent — re-applying when already configured is a no-op ('present') ---
+{
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-cdxlb-idem-'));
+    const cfg = path.join(dir, 'config.toml');
+    const seeded = helpers.upsertCodexLbConfig('', BASE_URL);
+    await helpers.safeWriteCodexConfigToml(cfg, '', seeded, 'codex-lb');
+    const cur = await fs.readFile(cfg, 'utf8');
+    const next = helpers.upsertCodexLbConfig(cur, BASE_URL);
+    const res = await helpers.safeWriteCodexConfigToml(cfg, cur, next, 'codex-lb');
+    results.push({ case: 'idempotent_present', ok: res.status === 'present' && res.changed === false, status: res.status });
+}
+const ok = results.every((r) => r.ok);
+if (!ok) {
+    console.error(JSON.stringify({ ok: false, message: 'codex-lb config TOML-safety regression failed', results }, null, 2));
+    process.exit(1);
+}
+emitGate('codex-lb:config-toml-safety', { cases: results.map((r) => r.case) });
+//# sourceMappingURL=codex-lb-config-toml-safety-check.js.map

package/dist/scripts/codex-lb-persistence-truth-check.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { exists, readText, runProcess } from '../core/fsx.js';
+const entry = './dist/bin/sks.js';
+const results = [];
+async function runSetup(name, args, input = 'sk-clb-test\n') {
+    const home = await fsp.mkdtemp(path.join(os.tmpdir(), `sks-lb-persist-${name}-`));
+    const result = await runProcess(process.execPath, [entry, 'codex-lb', 'setup', '--host', 'lb.example.test', '--api-key-stdin', '--json', ...args], {
+        input,
+        env: { ...process.env, HOME: home, CI: 'true', SKS_CODEX_LB_CHAIN_CHECK: '0', SKS_SKIP_CODEX_LB_LAUNCH_ENV: '1' },
+        timeoutMs: 20_000,
+        maxOutputBytes: 256 * 1024
+    });
+    return {
+        home,
+        result,
+        json: parseJson(result.stdout),
+        configPath: path.join(home, '.codex', 'config.toml'),
+        envPath: path.join(home, '.codex', 'sks-codex-lb.env')
+    };
+}
+{
+    const row = await runSetup('plan', ['--plan', '--no-env-file', '--no-keychain', '--no-launchctl', '--shell-profile', 'skip']);
+    results.push({
+        name: 'plan_writes_nothing_and_reports_process_only',
+        ok: row.result.code === 0
+            && row.json.writes === false
+            && row.json.persistence?.effective_mode === 'process_only_ephemeral'
+            && !(await exists(row.configPath))
+            && !(await exists(row.envPath))
+    });
+}
+{
+    const row = await runSetup('requires-yes', ['--no-env-file', '--no-keychain', '--no-launchctl', '--shell-profile', 'skip']);
+    results.push({
+        name: 'process_only_requires_yes',
+        ok: row.result.code === 1 && row.json.status === 'process_only_requires_yes' && row.json.persistence?.warning === 'process_only_ephemeral'
+    });
+}
+{
+    const row = await runSetup('process-only', ['--yes', '--no-env-file', '--no-keychain', '--no-launchctl', '--shell-profile', 'skip']);
+    results.push({
+        name: 'process_only_warns_and_writes_no_env',
+        ok: row.result.code === 0
+            && row.json.persistence?.effective_mode === 'process_only_ephemeral'
+            && row.json.persistence?.durable === false
+            && row.json.persistence?.warnings?.includes('next_shell_requires_setup_or_env')
+            && !(await exists(row.envPath))
+    });
+}
+{
+    const row = await runSetup('durable-env', ['--yes', '--write-env-file', '--no-keychain', '--no-launchctl']);
+    const envText = await readText(row.envPath, '');
+    results.push({
+        name: 'durable_env_file_mode',
+        ok: row.result.code === 0
+            && row.json.persistence?.applied_modes?.includes('durable_env_file')
+            && row.json.persistence?.durable === true
+            && /CODEX_LB_API_KEY/.test(envText)
+    });
+}
+{
+    const row = await runSetup('action-report', ['--yes', '--write-env-file', '--no-keychain', '--no-launchctl', '--shell-profile', 'skip']);
+    const actions = row.json.applied_actions?.map((action) => action.type) || [];
+    results.push({
+        name: 'applied_actions_match_actual_choices',
+        ok: row.result.code === 0
+            && actions.includes('write_env_file')
+            && !actions.includes('store_keychain')
+            && !actions.includes('sync_launchctl')
+            && !actions.includes('install_shell_profile_snippet')
+            && row.json.drift?.length === 0
+    });
+}
+const secretLeaked = /sk-clb-test/.test(results.map((row) => JSON.stringify(row)).join('\n'));
+const ok = results.every((row) => row.ok) && !secretLeaked;
+console.log(JSON.stringify({
+    schema: 'sks.codex-lb-persistence-truth-check.v1',
+    ok,
+    results,
+    secret_leaked: secretLeaked
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=codex-lb-persistence-truth-check.js.map

package/dist/scripts/codex-lb-setup-fixture-check.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runProcess } from '../core/fsx.js';
+const home = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-codex-lb-fixture-home-'));
+const entry = path.resolve('dist/bin/sks.js');
+const status = await runProcess(process.execPath, [entry, 'codex-lb', 'status', '--json'], {
+    env: { ...process.env, HOME: home, CI: 'true' },
+    timeoutMs: 15_000,
+    maxOutputBytes: 128 * 1024
+});
+const setup = await runProcess(process.execPath, [entry, 'codex-lb', 'setup', '--host', 'lb.example.test', '--api-key-stdin', '--yes', '--json'], {
+    input: 'sk-fixture-secret\n',
+    env: { ...process.env, HOME: home, CI: 'true', SKS_CODEX_LB_CHAIN_CHECK: '0', SKS_SKIP_CODEX_LB_LAUNCH_ENV: '1' },
+    timeoutMs: 15_000,
+    maxOutputBytes: 128 * 1024
+});
+const combined = `${status.stdout}\n${status.stderr}\n${setup.stdout}\n${setup.stderr}`;
+const leaks = [];
+if (/Missing environment variable/i.test(combined))
+    leaks.push('raw_missing_env_message');
+if (/sk-fixture-secret/.test(combined))
+    leaks.push('api_key_leak');
+let statusJson = {};
+let setupJson = {};
+try {
+    statusJson = JSON.parse(status.stdout);
+}
+catch { }
+try {
+    setupJson = JSON.parse(setup.stdout);
+}
+catch { }
+const envPath = path.join(home, '.codex', 'sks-codex-lb.env');
+const envStat = await fs.stat(envPath).catch(() => null);
+const mode = envStat ? (envStat.mode & 0o777).toString(8) : null;
+const ok = status.code === 0
+    && setup.code === 0
+    && statusJson.setup_needed === true
+    && setupJson.ok === true
+    && setupJson.api_key?.redacted === true
+    && mode === '600'
+    && leaks.length === 0;
+console.log(JSON.stringify({
+    schema: 'sks.codex-lb-setup-fixture-check.v1',
+    ok,
+    home,
+    status_code: status.code,
+    setup_code: setup.code,
+    setup_needed: statusJson.setup_needed === true,
+    configured: setupJson.ok === true,
+    env_mode: mode,
+    leaks
+}, null, 2));
+if (!ok && leaks.length)
+    await recordCodexLbWrongness(leaks);
+if (!ok)
+    process.exitCode = 1;
+async function recordCodexLbWrongness(leaks) {
+    const { addWrongnessRecord } = await import('../core/triwiki-wrongness/wrongness-ledger.js');
+    await addWrongnessRecord(process.cwd(), {
+        route: '$CodexLB',
+        wrongness_kind: 'codex_lb_missing_env_raw_message',
+        severity: 'high',
+        claim: { text: `codex-lb fixture exposed forbidden output: ${leaks.join(', ')}` },
+        detected_by: {
+            source: 'codex_lb_setup_fixture',
+            command: 'npm run codex-lb:setup-fixture',
+            artifact: 'dist/scripts/codex-lb-setup-fixture-check.js',
+            detail: leaks.join(', ')
+        },
+        root_cause: {
+            category: 'route_policy_gap',
+            explanation: 'codex-lb setup/status must convert missing key states into structured setup guidance without secret leakage.'
+        },
+        corrective_action: {
+            summary: 'Repair codex-lb env loading, setup output, or redaction before release.',
+            required_evidence: ['npm run codex-lb:setup-fixture'],
+            patch_status: 'pending'
+        },
+        avoidance_rule: {
+            text: 'Do not print raw CODEX_LB_API_KEY missing messages; use setup wizard guidance and redaction.',
+            applies_to: ['codex-lb', 'release'],
+            severity: 'high'
+        },
+        links: { tests: ['npm run codex-lb:setup-fixture'], files: ['dist/scripts/codex-lb-setup-fixture-check.js'] }
+    });
+}
+//# sourceMappingURL=codex-lb-setup-fixture-check.js.map

package/dist/scripts/codex-lb-setup-truthfulness-check.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runProcess, exists, readText } from '../core/fsx.js';
+const entry = './dist/bin/sks.js';
+const results = [];
+async function runSetup(name, args, input = 'sk-clb-test\n') {
+    const home = await fsp.mkdtemp(path.join(os.tmpdir(), `sks-lb-truth-${name}-`));
+    const result = await runProcess(process.execPath, [entry, 'codex-lb', 'setup', '--host', 'lb.example.test', '--api-key-stdin', '--yes', '--json', ...args], {
+        input,
+        env: { ...process.env, HOME: home, CI: 'true', SKS_CODEX_LB_CHAIN_CHECK: '0', SKS_SKIP_CODEX_LB_LAUNCH_ENV: '1' },
+        timeoutMs: 20_000,
+        maxOutputBytes: 256 * 1024
+    });
+    let json = {};
+    try {
+        json = JSON.parse(result.stdout);
+    }
+    catch { }
+    return {
+        home,
+        code: result.code,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        json,
+        configPath: path.join(home, '.codex', 'config.toml'),
+        envPath: path.join(home, '.codex', 'sks-codex-lb.env')
+    };
+}
+{
+    const row = await runSetup('plan', ['--plan']);
+    results.push({
+        name: 'plan_writes_nothing',
+        ok: row.code === 0 && row.json.writes === false && !(await exists(row.configPath)) && !(await exists(row.envPath))
+    });
+}
+{
+    const row = await runSetup('no-default', ['--no-default-provider']);
+    const config = await readText(row.configPath, '');
+    results.push({
+        name: 'no_default_provider',
+        ok: row.code === 0 && row.json.ok === true && config.includes('[model_providers.codex-lb]') && !/^\s*model_provider\s*=\s*"codex-lb"/m.test(config)
+    });
+}
+{
+    const row = await runSetup('no-env', ['--no-env-file']);
+    results.push({
+        name: 'no_env_file',
+        ok: row.code === 0 && row.json.ok === true && !(await exists(row.envPath))
+    });
+}
+{
+    const row = await runSetup('shell-skip', ['--shell-profile', 'skip']);
+    const touched = ['.zshrc', '.bashrc', '.config/fish/config.fish'];
+    results.push({
+        name: 'shell_profile_skip',
+        ok: row.code === 0 && touched.every((file) => !row.json.applied_actions?.some((action) => action.type === 'install_shell_profile_snippet') && !row.stdout.includes(file))
+    });
+}
+{
+    const row = await runSetup('report', ['--no-keychain', '--no-launchctl']);
+    const actions = row.json.applied_actions?.map((action) => action.type) || [];
+    results.push({
+        name: 'action_report_matches_choices',
+        ok: row.code === 0
+            && actions.includes('write_config_provider')
+            && actions.includes('write_env_file')
+            && !actions.includes('store_keychain')
+            && !actions.includes('sync_launchctl')
+            && row.json.drift?.length === 0
+    });
+}
+const text = results.map((row) => `${row.name}:${row.ok}`).join('\n');
+const ok = results.every((row) => row.ok) && !/sk-clb-test/.test(text);
+console.log(JSON.stringify({
+    schema: 'sks.codex-lb-setup-truthfulness-check.v1',
+    ok,
+    results
+}, null, 2));
+if (!ok)
+    process.exitCode = 1;
+//# sourceMappingURL=codex-lb-setup-truthfulness-check.js.map

package/dist/scripts/codex-legacy-profile-consumers-removed-check.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { root } from './lib/ensure-dist-fresh.js';
+const files = [
+    'src/core/codex/codex-project-config-policy.ts',
+    'src/core/codex/codex-cli-syntax-builder.ts',
+    'src/core/agents/agent-runner-codex-exec.ts',
+    'src/core/agents/codex-exec-worker-adapter.ts'
+];
+const issues = [];
+for (const rel of files) {
+    const text = await fs.readFile(path.join(root, rel), 'utf8');
+    if (/\$\{profileName\}\.config\.toml|selected_profile_table_moved_to_profile_config/.test(text))
+        issues.push(`${rel}:legacy_profile_config_file_consumer`);
+    if (/codex_permission_profile[^]*--profile/.test(text))
+        issues.push(`${rel}:permission_profile_confused_with_config_profile`);
+}
+const ok = issues.length === 0;
+emit({ schema: 'sks.codex-legacy-profile-consumers-removed-check.v1', ok, files, issues });
+function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
+    process.exitCode = 1; }
+//# sourceMappingURL=codex-legacy-profile-consumers-removed-check.js.map

package/dist/scripts/codex-managed-proxy-env-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const mod = await importDist('core/codex/managed-proxy-env.js');
+const env = {
+    HTTPS_PROXY: 'http://user:secret@example.test:8080',
+    NO_PROXY: 'localhost,127.0.0.1'
+};
+const childEnv = mod.managedProxyEnvForChild(env);
+const report = mod.detectManagedProxyEnv(env);
+assertGate(report.ok === true, 'managed proxy env report must be ok', report);
+assertGate(report.keys_present.includes('HTTPS_PROXY'), 'managed proxy env must detect HTTPS_PROXY', report);
+assertGate(childEnv.HTTPS_PROXY.includes('secret'), 'child env keeps the real proxy value for process propagation', report);
+assertGate(!JSON.stringify(report).includes('secret'), 'managed proxy env report must not persist raw proxy secret', report);
+assertGate(!report.redacted.HTTPS_PROXY.includes('secret'), 'redacted report must not expose proxy password', report);
+emitGate('codex:managed-proxy-env', { keys: report.keys_present });
+//# sourceMappingURL=codex-managed-proxy-env-check.js.map

package/dist/scripts/codex-model-metadata-check.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+process.env.SKS_CODEX_MODEL_METADATA_FAKE = '1';
+process.env.SKS_CODEX_MODEL_EFFORTS = 'low,medium,high,xhigh';
+const mod = await importDist('core/codex-control/codex-model-metadata.js');
+const metadata = await mod.collectCodexModelMetadata({ model: 'gpt-5.5' });
+assertGate(metadata.source === 'app-server' && metadata.advertised_efforts.includes('xhigh'), 'Codex model metadata collector must expose advertised efforts');
+emitGate('codex:model-metadata', { source: metadata.source, efforts: metadata.advertised_efforts });
+//# sourceMappingURL=codex-model-metadata-check.js.map

package/dist/scripts/codex-native-agent-role-content-check.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { syncCodexAgentRoles } from '../core/codex-app/codex-agent-role-sync.js';
+const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'sks-agent-role-content-'));
+const codexHome = path.join(root, 'codex-home');
+const report = await syncCodexAgentRoles({ root, codexHome, apply: true, agentTypeSupported: true });
+const checker = await fs.promises.readFile(path.join(codexHome, 'agents', 'sks-checker.toml'), 'utf8');
+const implementer = await fs.promises.readFile(path.join(codexHome, 'agents', 'sks-implementer.toml'), 'utf8');
+for (const token of ['Bounded ownership', 'Maker/checker separation', 'Allowed sandbox', 'Side-effect restrictions', 'Required proof artifacts', 'Final arbiter constraints']) {
+    assertGate(checker.includes(token) && implementer.includes(token), `managed agent role missing:${token}`);
+}
+assertGate(checker.includes('sandbox_mode = \"read-only\"') && checker.includes('checker is read-only'), 'checker role must be read-only');
+assertGate(implementer.includes('cannot self-approve'), 'implementer role must not self-approve');
+assertGate(report.strategy === 'agent_type' && report.probe_artifact_path && report.clobbered_user_roles === false, 'agent role report strategy/probe/no-clobber fields missing');
+emitGate('codex-native:agent-role-content');
+function assertGate(condition, message) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=codex-native-agent-role-content-check.js.map

package/dist/scripts/codex-native-broker-read-only-check.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
+import { createCodexNativeRuntimeFixture, withFixtureEnv } from './codex-native-runtime-e2e-fixture.js';
+const fixture = await createCodexNativeRuntimeFixture({
+    hook: 'approved',
+    agentType: 'supported',
+    appHandoff: true,
+    imagePathExposure: true,
+    mcpCandidates: true,
+    codeModeWebSearch: true
+});
+await withFixtureEnv(fixture, async () => {
+    await fs.mkdir(path.join(fixture.root, 'codex-home', 'skills', 'user-skill'), { recursive: true });
+    await fs.writeFile(path.join(fixture.root, 'codex-home', 'skills', 'user-skill', 'SKILL.md'), '# user skill\n', 'utf8');
+    await fs.mkdir(path.join(fixture.root, 'codex-home', 'agents'), { recursive: true });
+    await fs.writeFile(path.join(fixture.root, 'codex-home', 'agents', 'user-role.toml'), 'name = "user-role"\n', 'utf8');
+    const matrix = await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
+    assertGate(matrix.schema === 'sks.codex-native-feature-matrix.v1', 'broker matrix schema mismatch', matrix);
+    assertGate(matrix.features.skill_sync.ok === false && matrix.features.agent_roles.ok === false, 'read-only matrix counted non-SKS managed assets', matrix);
+    assertGate(!(await exists(path.join(fixture.root, '.agents', 'skills'))), 'read-only matrix created project skills');
+    assertGate(!(await exists(path.join(fixture.root, '.codex', 'agents'))), 'read-only matrix created project agent roles');
+});
+emitGate('codex-native:broker-read-only');
+async function exists(file) {
+    try {
+        await fs.stat(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=codex-native-broker-read-only-check.js.map

package/dist/scripts/codex-native-feature-broker-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:feature-broker-blackbox');
+//# sourceMappingURL=codex-native-feature-broker-blackbox.js.map

package/dist/scripts/codex-native-feature-broker-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:feature-broker');
+//# sourceMappingURL=codex-native-feature-broker-check.js.map

package/dist/scripts/codex-native-harness-compat-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:harness-compat');
+//# sourceMappingURL=codex-native-harness-compat-check.js.map

package/dist/scripts/codex-native-hook-lifecycle-proof-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:hook-lifecycle-proof');
+//# sourceMappingURL=codex-native-hook-lifecycle-proof-check.js.map

package/dist/scripts/codex-native-interop-policy-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:interop-policy');
+//# sourceMappingURL=codex-native-interop-policy-check.js.map

package/dist/scripts/codex-native-invocation-defaults-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:invocation-defaults');
+//# sourceMappingURL=codex-native-invocation-defaults-check.js.map

package/dist/scripts/codex-native-invocation-router-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:invocation-router');
+//# sourceMappingURL=codex-native-invocation-router-check.js.map

package/dist/scripts/codex-native-pattern-analysis-blackbox.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:pattern-analysis-blackbox');
+//# sourceMappingURL=codex-native-pattern-analysis-blackbox.js.map

package/dist/scripts/codex-native-pattern-analysis-check.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runDirective316Gate } from './sks-3-1-6-directive-check-lib.js';
+await runDirective316Gate('codex-native:pattern-analysis');
+//# sourceMappingURL=codex-native-pattern-analysis-check.js.map

package/dist/scripts/codex-native-read-repair-split-blackbox.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildCodexNativeFeatureMatrix } from '../core/codex-native/codex-native-feature-broker.js';
+import { repairCodexNativeManagedAssets } from '../core/codex-native/codex-native-repair-transaction.js';
+import { createCodexNativeRuntimeFixture, withFixtureEnv } from './codex-native-runtime-e2e-fixture.js';
+const fixture = await createCodexNativeRuntimeFixture({
+    hook: 'approved',
+    agentType: 'supported',
+    appHandoff: true,
+    imagePathExposure: true,
+    mcpCandidates: true,
+    codeModeWebSearch: true
+});
+const previous = process.env.CODEX_HOME;
+process.env.CODEX_HOME = path.join(fixture.root, 'codex-home');
+try {
+    await withFixtureEnv(fixture, async () => {
+        await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
+        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'skills'))), 'read-only matrix created skills');
+        assertGate(!(await exists(path.join(fixture.root, 'codex-home', 'agents'))), 'read-only matrix created agent roles');
+        const repair = await repairCodexNativeManagedAssets({ root: fixture.root, requestedBy: 'manual', yes: true });
+        assertGate(repair.repaired.some((row) => row.asset === 'skills'), 'repair transaction did not include skills', repair);
+        assertGate(await exists(path.join(fixture.root, 'codex-home', 'skills')), 'repair transaction did not create managed skills');
+        assertGate(await exists(path.join(fixture.root, 'codex-home', 'agents')), 'repair transaction did not create managed agent roles');
+        const matrixAfter = await buildCodexNativeFeatureMatrix({ root: fixture.root, mode: 'read-only' });
+        assertGate(matrixAfter.features.skill_sync.ok === true || matrixAfter.features.agent_roles.ok === true, 'post-repair read-only matrix did not reflect managed assets', matrixAfter);
+    });
+}
+finally {
+    if (previous === undefined)
+        delete process.env.CODEX_HOME;
+    else
+        process.env.CODEX_HOME = previous;
+}
+emitGate('codex-native:read-repair-split-blackbox');
+async function exists(file) {
+    try {
+        await fs.stat(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=codex-native-read-repair-split-blackbox.js.map

package/dist/scripts/codex-native-reference-cache-blackbox.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runProcess } from '../core/fsx.js';
+import { ensureCodexNativeReferenceSnapshot } from '../core/codex-native/codex-native-reference-cache.js';
+import { analyzeCodexNativeReferenceSource } from '../core/codex-native/codex-native-reference-source.js';
+const missing = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-missing-'));
+const missingReport = await ensureCodexNativeReferenceSnapshot({ root: missing, offline: true });
+assertGate(missingReport.ok === false && missingReport.blockers.includes('source_snapshot_missing'), 'offline no-cache scenario must report source_snapshot_missing', missingReport);
+const missingEvidence = await analyzeCodexNativeReferenceSource({ root: missing, writeReport: false });
+assertGate(missingEvidence.blockers.includes('source_snapshot_missing') && missingEvidence.evidence.length === 0, 'missing cache must not hallucinate evidence', missingEvidence);
+const reused = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-reused-'));
+await fs.mkdir(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference'), { recursive: true });
+await fs.writeFile(path.join(reused, '.sneakoscope', 'cache', 'codex-native-reference', 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
+const reusedReport = await ensureCodexNativeReferenceSnapshot({ root: reused, offline: true });
+assertGate(reusedReport.ok === true && reusedReport.refreshed === false, 'offline existing cache should be reused', reusedReport);
+const source = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-source-'));
+await fs.writeFile(path.join(source, 'README.md'), 'npx plugin hook agent_type fallback AGENTS.md doctor MCP managed proof\n', 'utf8');
+await runProcess('git', ['init'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
+await runProcess('git', ['add', 'README.md'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
+await runProcess('git', ['-c', 'user.email=sks@example.invalid', '-c', 'user.name=SKS', 'commit', '-m', 'fixture'], { cwd: source, timeoutMs: 10_000, maxOutputBytes: 64 * 1024 });
+const refreshedRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-reference-cache-refresh-'));
+const refreshed = await ensureCodexNativeReferenceSnapshot({ root: refreshedRoot, sourceUrl: source, refresh: true });
+const serialized = JSON.stringify(refreshed);
+assertGate(refreshed.ok === true && refreshed.refreshed === true && typeof refreshed.source_sha === 'string', 'refresh from local git source should record source sha', refreshed);
+assertGate(!serialized.includes(source), 'cache report leaked raw source URL/path', refreshed);
+const evidence = await analyzeCodexNativeReferenceSource({ root: refreshedRoot, writeReport: true });
+const docs = await fs.readFile(path.join(refreshedRoot, 'docs', 'codex-native-patterns.md'), 'utf8');
+assertGate(!JSON.stringify(evidence).includes(source) && !docs.includes(source), 'reference evidence/docs leaked raw source URL/path', { evidence, docs });
+emitGate('codex-native:reference-cache-blackbox');
+function assertGate(condition, message, detail = {}) {
+    if (condition)
+        return;
+    console.error(JSON.stringify({ ok: false, message, detail }, null, 2));
+    process.exit(1);
+}
+function emitGate(gate) {
+    console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
+}
+//# sourceMappingURL=codex-native-reference-cache-blackbox.js.map